PT-2026-28727 · Elecv2 · Elecv2
CVSS v4.0
5.5
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P |
Name of the Vulnerable Software and Affected Versions
elecV2 versions up to 3.8.3
Description
A flaw exists in the function
path.join within the file /store/:key. Manipulation of the URL argument can lead to path traversal, allowing for remote exploitation. The exploit has been publicly disclosed. The project was notified of the issue but has not yet responded.Recommendations
Versions prior to 3.8.4 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Elecv2